Cookies and Local Storage
Version: 1.0
Effective date: 31 October 2026
Language: English
1. Scope
This document describes cookies and storage used by the Tape Music Stories website and PNAM Library. The controller is Riccardo Consolandi; contact riccardo.consolandi.eng@gmail.com. For server-side data and rights, consult the Privacy Policy.
The website does not use analytics, advertising pixels or application tools for profiling. Technical storage necessary for requested functions is separate from optional third-party content.
2. First-party storage
The first-party storage listed below has technical purposes or is necessary for functions expressly requested by the user. It is not used for profiling, behavioural advertising or analysis of browsing habits. No separate prior consent is requested for such storage to the extent that it remains strictly necessary for the respective functions. This classification does not automatically extend to the player or third-party tools.
| Name | Type and function | Duration and scope |
|---|---|---|
tms-lang | localStorage: retains the language preference in the origin where it is set | Isolated by origin (scheme, host and port); no predetermined application expiry; removable through the browser. If TMS and the Library are on different origins, their respective storage is not automatically shared |
__Host-pnam_session | Technical authentication/session and request-protection cookie | In production: Secure, Path=/, no Domain, HttpOnly and SameSite=Strict. Maximum server-side validity: 30 minutes for an anonymous session, 12 hours for an ordinary authenticated session, 15 minutes for restricted access to suspension review. The service configures the cookie with the corresponding Max-Age; the server may invalidate the session earlier |
pnam-studio-browser-code | sessionStorage: temporary code to complete Studio connection after sign-in | Website tab/origin; 10-minute client-side expiry and removal in approval, denial, invalidity or expiry paths; it contains no passwords or bearer tokens |
The stated periods distinguish server-side validity from cookie storage in the browser: retaining a copy does not extend an expired or revoked session. The browser may delete or block the cookie earlier. The __Host- prefix is accompanied by the attributes required above, not by a domain shared across subdomains. Inactivity of 30 minutes, logout, revocation or security changes may invalidate a session before its maximum expiry. Restricted access does not restore ordinary account powers.
CSRF protection is handled in page memory and linked to the session; it is not an advertising cookie or dedicated profiling storage. Keeping codes in the browser does not extend their server-side validity. Server-record deletion periods are separate and described in the Privacy Policy.
3. Confirmation before software download
The download-confirmation window retains the choice only in the window's memory for that operation. It is reset when reopened; the service does not record confirmation in an account, cookies, localStorage or a server-side acceptance register.
Any ordinary download access logs are not individual proof of EULA acceptance. Confirmation does not activate tracking or newsletters.
4. Media and external links
The website uses system fonts, local images and embedded icons: it does not automatically load Google Fonts, remote YouTube thumbnails or social SDKs.
Spotify player: optional loading
Spotify is not automatically contacted to load the player when the page opens. The player is created only after clicking the “Play” command in the Spotify panel. Before the click, the panel states that this is third-party content and that loading it connects the browser to Spotify.
Loading the player connects the browser to Spotify, which may process network address, technical data and its own storage under the Spotify Privacy Policy. The provider's conditions are separate from PNAM's.
You may choose not to load the player and continue using the other parts of the website. The website does not automatically remember the choice for subsequent visits. The “Stop” command removes the player from the page; loading it again requires another click. Removal stops subsequent communications from that player, but does not delete data already transmitted or stored by the provider. You may manage the provider's storage through your browser or Spotify tools. Accepting the Library Terms or confirming a software download does not constitute consent to Spotify.
Links to YouTube, Spotify, Instagram, TikTok and other websites open the services selected by the user under their own conditions. They are not equivalent to automatically loading a player or pixel on the TMS page.
5. User control
You may manage or delete cookies and storage through browser settings, change language, avoid loading optional media and use logout or authorisation revocation. Blocking technical cookies may prevent sign-in and submission of protected forms, including a report without an account; it does not turn registration into a requirement for reporting.
HTTP cache, password managers and independent browser settings are separate from the application storage described here. The website does not use dedicated application persistence through IndexedDB, Service Workers or Cache API. This does not exclude technical data processed by networks, hosting and external websites.
Any new non-essential tools must be described and subject to the required choices before activation. The Terms and sharing declarations do not authorise advertising or tracking. For the regulatory framework, consult the Italian Data Protection Authority's guidelines.